Privacy and Security Review Medical Device Reordering System

[leahkeeler]

Steps to complete the Privacy & Security Review:

• [x] Lead engineer or product manager: using this template, create issue and fill in feature name in the title
• [x] Reach out to Andrew Gunsch (@ gunsch in Slack) to schedule a 60 minute meeting
• [x] VSP privacy and security review team provides written feedback for your team on your feature, including clear action items to complete
• [x] Requesting team completes action items
• [x] Requesting team requests validation of completed action items and signoff from Andrew Gunsch before rollout
• [x] All requesting team attendees complete brief VSP Collaboration Cycle Feedback survey

Artifacts - please provide the following artifacts 2 days before scheduled meeting

• An architecture diagram, showing involved systems + data flows
• Description of any new publicly-exposed endpoints (vets-api or otherwise)
• Description of any new interactions with dependent services (i.e. vets-api --> ???)
• Description of any other security hotspots you're concerned about / want extra attention on

Meeting attendees from requesting team

• Lead engineer (required): Cameron
• Product manager (required): Leah
• DEPO product lead (required): Matt
• Anyone else on your team whose presence is needed to speak to the technical architecture and security concerns (required):

Scheduling

Preferred dates or times: Any time after 6/3

Additional Notes

Following this review, VSP engineers will provide a list of concrete action items that need to be addressed, or approval to begin roll out

[voidspooks]

System Architecture

[gunsch]

Thanks for a great review!

AIs from this meeting:

• [ ] Look into: how would the JWT expiring manifest to the user?
• [ ] Look into: DLC API and how they trust vets-api as a caller. Recommend that they don't allow production calls from everyone with network access to their API. (For comparison, we use client certs to authenticate vets-api to most other VA backends.)
• [ ] Look into load testing for your service
• [ ] Look into what controls eBenefits has for %-based traffic-splitting (not mandatory for this launch, but could be relevant for future launches)
• [ ] Consider a rollout plan of rolling out organically on VA.gov rather than traffic-redirection from eBenefits

While some of these AIs are relevant to the launch (especially the load testing + rollout plan), I don't consider any of these launch-blocking from security/privacy perspective. You're welcome to close this ticket once you've completed the above AIs, or moved them into separate tickets --- however you want to track.

Good luck with your launch!

Review notes (VSP-access only): https://docs.google.com/document/d/1qJLzDMmd6TaQAe_9Rs461-nG4ZBBVEZxD6HQS0xTN6A/edit#

[leahkeeler]

Moved to backlog - revisit load testing once live

[leahkeeler]

This is complete

[gunsch]

You're welcome to close this ticket once you've completed the above AIs, or moved them into separate tickets --- however you want to track.

@leahkeeler can you share more about this? did you complete all the things above, or if not can you link to tickets for the remaining work?

[gunsch]

passing onto @f1337 to evaluate when finished